2022

Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.

Global buffer overflow vulnerability exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23705. Issue is in th

Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23852. Issu

TP-Link WR886N 3.0 1.0.1 Build 150127 Rel.34123n is vulnerable to Buffer Overflow. Authenticated attackers can crash rou

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.

Cross-site scripting vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to inject an

Reflected cross-site scripting vulnerability in the checkbox of php_mailform versions prior to Version 1.40 allows a rem

Reflected cross-site scripting vulnerability in the attached file name of php_mailform versions prior to Version 1.40 al

Cross-site scripting vulnerability in ELECOM LAN router WRC-300FEBK-R firmware v1.13 and earlier allows an attacker on t

Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9

Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF

Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.

Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.

Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.

QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at "adminuseredit.php?usertoedit=XSS", as the us

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can c

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for priva

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of in

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficie

Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - ma

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Edge (Chromium-based) Tampering Vulnerability

The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vul

The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable

The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1

The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privile

The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in

The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the

The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do n

The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before ou

The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which co

The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is u

The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX act

The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_r

The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_or

The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which c

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back i

The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could all

In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service manageme

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Managemen

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management fun

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management fun

Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

Cross-site Scripting (XSS) - Reflected in Packagist ptrofimov/beanstalk_console prior to 1.7.12.

Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.

Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9

Wire webapp is a web client for the wire messaging protocol. In versions prior to 2022-01-27-production.0 expired epheme